# CVE-2026-82884: All in One SEO WordPress plugin Stored XSS via AI Assistant Block

Source: https://junglewise.ai/threats/cve-2026-82884-all-in-one-seo-wordpress-plugin-stored-xss-via-ai-assistant-block  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82884 · Severity: medium · CVSS 6.8 · Published 2026-09-02

All in One SEO is a popular WordPress plugin that manages search engine optimization metadata and settings for WordPress sites. A stored cross-site scripting (XSS) vulnerability in the AI Assistant block allows attackers with contributor-level access to inject malicious code into posts that executes when higher-privileged administrators or editors view the post, potentially compromising their accounts and site security.

Technologies: [All in One SEO](https://junglewise.ai/threats/technologies/all-in-one-seo). Vendors: [All in One SEO](https://junglewise.ai/threats/vendors/all-in-one-seo).

## Quick answers

**Is CVE-2026-82884 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82884 being exploited in the wild.

**How severe is CVE-2026-82884?** Medium severity, with a CVSS score of 6.8, published 2 September 2026.

**Which products and versions are affected?** All in One SEO before 5.0.0.1.

**Is there a fix for CVE-2026-82884?** A patch was published on 2026-09-02: Fixed in version 5.0.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82884 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82884?** Check whether you run All in One SEO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored XSS flaw (CWE-79) in the AI Assistant block component that fails to properly sanitize and escape user-controlled content before rendering it in the WordPress post editor. An attacker with contributor role or higher can inject JavaScript payload within the block's JSON attributes (specifically the "content" field), which is then stored in the post. When an administrator or editor opens the post in the block editor, the unescaped payload executes in their browser session with their privileges. The attack requires the attacker to have contributor-level access to create/modify posts, but impacts higher-privileged users. The vulnerability is fixed in version 5.0.0.1.

## Affected products

- All in One SEO All in One SEO before 5.0.0.1

## Timeline

- 2026-09-01: disclosed
- 2026-09-02: published
- 2026-09-02: patched: Fixed in version 5.0.0.1

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/9d4e5075-062a-42d7-beba-9f96f9ce76da/](https://wpscan.com/vulnerability/9d4e5075-062a-42d7-beba-9f96f9ce76da/)

## Related threats

- [All in One SEO sensitive information exposure in internalOptions](https://junglewise.ai/threats/cve-2026-5075-all-in-one-seo-sensitive-information-exposure-in-internaloptions)